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Noveity (N) 


Yes: 


Claims 
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No: 


Claims 




Inventive step (IS) 


Yes: 


Claims 
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No: 


Claims 


1,3-9 


Industrial applicability (IA) 


Yes: 


Claims 


1-9 




No: 


Claims 





2. Citations and explanations 
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Re item V 

Reasoned statement yimdeir ArtScie 35(2) with regard to novelty, inventive step or 
ondustoiall appliicabiilliity; citations and! explanations supporting such statement 

1 . Reference is made to the following documents: 

D1: EP-A-0 304 998 (PHILIPS NV) 1 March 1989 

D2: US-A-5 625 888 (RUETHER RALF ET AL) 29 April 1997 

D3: US-A-5 371 783 (HEUNG CHARLEY ET AL) 6 December 1994 

D4: EP-A-0 301 573 (NIPPON ELECTRIC CO) 1 February 1989 

2. The application does not meet the requirements of the PCT because the subject- 
matter of claim 11 does not involve an inventive step (Article 33(3) PCT). 

Document D1, which is considered to represent the most relevant state of the art, 

discloses (see in particular column 2, line 29- column 3, line 3; column 4, lines 5- 

10; Fig. 1; column 5, line 43- column 6, line 49; Fig. 5), according to essential 

features of claim 1, a wireless telephone system which comprises: 

one or more wireless handsets, each handset comprising a handset transceiver; 

and 

a base unit comprising 

a handset docking station having a wired interface (see in particular Fig. 1) 
means for initializing the handset via the wired interface, when the handset is 
physically docked in the docking station (see in particular column 4, lines 5- 10); 
and 

a base transceiver for communicating over a channel with each handset via its 
handset transceiver only if the handset has previously been initialized by the base 
unit (see in particular the wording "the base station makes security checks on the 
handsets using ... the ... security code address" in column 3, lines 1-2). 

The subject-matter of claim 1 differs from that disclosed in D1 only in that 
during initialization a unique handset security code based on a unique and 
permanent handset serial number is read from the handset and stored to the base 
station 
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and that the determination wether the handset has been previously initialized is 
based on this handset security code. 

Thereby secure communications between handsets and the base unit shall be 
achieved. 

However, document D2 discloses, for the same purpose of providing a secure 
communication between handsets and a base unit (see in particular the 
correspondence between the wording "conduct unauthorized telephone calls" in 
column 2, lines 42- 49 of D2 and the wording "an unauthorized third party may 
use a bootleg wireless handset to communicate via the base unit" on page 2, line 
2 of the application) , an initialization in which a unique and permanent handset 
security code is read from the handset and stored to the base station, see column 
6, lines 29- 38. From the wording "an individual identification word allocated to the 
mobile station during its manufacture" it is clear that the difference between this 
unique and permanent handset security code and a "serial number" is of semantic 
nature. That the determination wether the handset has been previously initialized 
is based on the handset security code is implicitly included in such a scheme: 
otherwise there would be no reason for storing the handset security code in the 
base unit. Furthermore, it should be noted that the use of "serial numbers" as a 
basis for unique device security codes is explicitly disclosed in document D4 (see 
in particular column 1, lines 36- 41), which is referenced by document D2 and is 
therefore part of the disclosure of this document. 

Consequently, the differentiating features have already been employed in a similar 
wireless telephone system according to document D2 and it would therefore be 
obvious to the person skilled in the art, namely when the same result is to be 
achieved, to apply these features with corresponding effect to a wireless 
telephone system according to document D1, thereby arriving at a wireless 
telephone system according to claim 1 . The subject-matter of claim 1 does 
therefore not involve an inventive step (Article 33(3) PCT). 

3. The application does not meet the requirements of the PCT because the subject- 
matter of independent ctaoms 8 and 9 does not involve an inventive step (Article 
33(3) PCT). 
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The subject-matter of claims 8 and 9, which are directed to a method and a base 
unit, respectively, corresponds substantially to that of claim 1. 

Therefore the objection as to lack of inventive step of claim 1 is applicable mutatis 
mutandis to claims 8 and 9. 

4. Dependent claims 3 Ho 7 do not contain any features which, in combination with 
the features of any claim to which they refer, meet the requirements of the PCT in 
respect of inventive step, the reasons being as follows. 

The use of TDMA and therefore the bargaining of an audio slot (claim 3) is 
generally known from DECT-systems as disclosed in D2. 

Scrambling (ciaom 4), which always necessitates knowledge of the scrambler 
seed by both parties of the communication, is common in radio systems, see e.g. 
D3, column 3, lines 54- 60). 

A charging means (claim 5) is known from D1 (see in particular column 4, 
lines 5- 7). 

Ensuring that the handset is sufficiently charged when performing the initialization 
(cBaSm 6) is known from D1 (see in particular column 6, lines 18- 22). This ensures 
correct retransmission of a signal during initialization, i.e. it serves the same 
purpose of permitting normal functioning of the handset during initialization (see 
the paragraph bridging pages 8 and 9 of the application). Once this problem has 
been realized, as it has been in document D1, providing means for determining 
whether the voltage of the handset is below a threshold level is merely one of 
several straightforward possibilities from which the skilled person would select, in 
accordance with circumstances, without the exercise of inventive skill, in order to 
solve the problem posed. 

Messages comprising a plurality of fields (claim 7) are well-known, see e.g. Fig. 5 
of D1 or Fig. 3 of D2. 
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5. However, Cllaflm 2 meets the requirements of Articles 33(2), (3) and (4) PCT. 

According to claim 2, in the wireless telephone system of claim 1 the base 
transceiver is adapted to communicate with a given handset only if the handset 
provides to the base unit its handset security code and a base unit security code 
which has been provided to the handset by the base unit. 

This yields a further improvement of the security of the communication between 
the handset and the base unit. 

Such a wireless telephone system is neither taught nor rendered obvious by the 
above-mentioned and the other prior art documents cited in the International 
Search Report. 

The subject-matter of claim 2 is therefore novel and considered to involve the 
required inventive step, Articles 33(2) and (3) PCT. The subject-matter of this 
claim is also industrially applicable, Article 33(4) PCT. 

Re item VBD 

Carta on deflects in the ontennialtooinial application 

The summary in the opening part of the description is not in agreement with the 
wording of the amended independent claims. 
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One problem that may be encountered in such situations is 
breach of security. For example, an unauthorized third party may use 
a "bootleg" wireless handset to communicate via the base unit. 
Without adequate security, these and other types of security breaches 
may occur. 



SUMMARY 

A wireless telephone system, having one or more wireless 
handsets and a base unit. Each handset has a handset transceiver, 

10 and the base unit has a base transceiver and a handset docking 
station, which has a wired interface. The base unit digitally 
communicates over an RF channel with a handset via its handset 
transceiver only if the handset has previously been initialized by the 
base unit. The handset is initialized via the wired interface when it is 

15 physically docked in the docking station. 

BRIEF DESCRI PTION OF THE DRAWINGS 

Fig. 1 is a block diagram of TDMA multi-line wireless telephone 
system for initializing wireless handsets of the system, in accordance 
with an embodiment of the present invention; 

20 Fig. 2 is a schematic representation of the message format for an 

initialization message exchange between the base unit and a handset 
of the telephone system of Fig. 1 via a wired link, for initializing the 
handset, in accordance with an embodiment of the present invention; 

Fig. 3 is a flow diagram illustrating the handset initialization 
25 performed by the system of Fig. 1, from the point of view of the base 
station, in accordance with an embodiment of the present invention; 
and 
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The rest of the processing chain shown in Fig. 4 (steps 405 et 
seq.) is a reflection of actions requested by the base. As discussed 
above, handset 12 0i needs to have a response for each of the possible 
states" that it can be in. In particular, depending on its initial status 
(which is one of 3 possible conditions discussed in the previous 
section), the base may request the following actions: local slot 
number assignment (step 406); User to Provide Local Message 
Assignment (step 407); or HS vs. Base ID Mismatch (step 408) 
(implying a requirement for a possible reprogramming of the handset 
based on the user's request). This allows a handset to be recharged in 
another base with the user prompting such an action only. Also, in 
the case where only a recharging function is carried out, there is no 
unique ring tone at the completion of the action. All other actions in 
the handset on completion result in a unique ring tone (step 425) 
15 which signals to the user that the handset and base have completed 
their actions. 

One skilled in the art will recognize that the wireless system 
described above according to the principles of the invention may be a 
cellular system where base unit 110 represents a base station serving 
20 one of the cells in a cellular telephone network. 

It will be understood that various changes in the details, 
materials, and arrangements of the pans which have been described 
and illustrated above in order to explain the nature of this invention 
may be made by those skilled in the art without departing from the 
25 principle and scope of the invention as recited in the following claims. 
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CLAIMS 



1. A wireless telephone system, comprising: 

5 (a) one or more wireless handsets, each handset comprising a 

handset transceiver; and 
(b) a base unit comprising a base transceiver for communicating 
over a channel with each handset via its handset 
transceiver only if the handset has previously been 
10 initialized by the base unit; a handset docking station 

having a wired interface; and 

means for initializing the handset via the wired interface. 

2. The system of claim 1, wherein: 

15 the means for initializing obtains from the handset and stores 

locally a unique handset security code; and 
the base unit allows a given handset to communicate over the 
channel only if the handset provides to the base unit the 
handset security code. 

20 

3. The system of claim 2, wherein: 

the means for initializing further provides a unique base unit 

security code to the handset; and 
the base unit allows a given handset to communicate over the 
25 channel only if the handset provides to the base unit the 

base unit security code and the handset security code. 
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4. The system of claim 2, wherein: 

the base transceiver establishes a time-division multiple access 
(TDM A) link with each handset via the handset 
transceiver in accordance with a TDMA epoch allocating 
exclusive audio packet time slots to each handset; 

the means for initializing obtains from the handset and stores 
locally a unique handset security code and provides to the 
handset an exclusive audio packet slot number 
corresponding to its audio packet time slot; and 

the base unit allows a given handset to communicate over the 
RF channel only if the handset provides to the base unit 
the handset security code and the audio packet slot 
number. 



5. The system of claim 2, wherein: 

digital communications between the base transceiver and the 
handset are scrambled in accordance with a scrambler 
seed unique to the handset that must be known to both 



the means for initializing provides to the handset and stores 
locally the scrambler seed for the handset. 



15 



20 



the base transceiver and the handset; and 



6. The system of claim 2, wherein the handset security code is 
25 based on a unique handset serial number. 
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7. The system of claim 1, wherein: 

the means for initializing provides to the handset a unique base 
unit security code based on a unique base unit serial 
number; and 

the base unit allows a given handset to conduct digital 
communications over the RF channel only if the handset 
provides to the base unit the base unit security code and 
the handset security code. 

8. The system of claim 1, wherein: 

each handset is battery powered by a rechargeable battery; and 
the docking station comprises a charging means for recharging 

the battery of a handset physically docked in the docking 

station. 

9. The system of claim 8, wherein: 

the base unit comprises means for determining whether the 
battery of the handset physically docked in the docking 
station has a voltage below a threshold level, wherein the 
means for initializing waits until after the battery voltage 
has been recharged above the threshold level before 
initializing the handset. 



10. The system of claim 1, wherein the handset and base unit 
exchange messages during the initialization in accordance with a 
message format comprising a plurality of fields. 
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11. In a wireless telephone system having a base unit and one 
or more wireless handsets, the base unit comprising a base 
transceiver and a handset docking station having a wired interface, 
each handset comprising a handset transceiver, a method comprising 

5 the steps of: 

(a) initializing a handset via the wired interface when the 

handset is physically docked in the docking station; and 

(b) conducting digital communications, over an RF channel, 

between the base unit and the handset via the base unit 
10 and handset transceivers, respectively, only if the handset 

has previously been initialized by the base unit. 

12. A base unit for communicating with one or more wireless 
handsets, each handset comprising a handset transceiver, comprising: 

15 < a > a base transceiver for digitally communicating over an RF 

channel with each handset via its handset transceiver only 
if the handset has previously been initialized by the base 
unit; and 

(b) a handset docking station having a wired interface, wherein 
20 toe base unit initializes the handsel via the wired 

interface when the handset is physically docked in the 
docking station. 
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INITIALIZATION OF HANDSETS IN A MULTI-LINE WIRELESS 
PHONE SYSTEM FOR SECURE COMMUNICATIONS 



5 FieBd of the Invention 

The present invention relates to multi-line wireless telephone 
systems and, in particular, to providing secure communications in a 
time-division multiplexed (TDM) wireless telephone system. 

BescriptiioB of the Related Art 

10 The use of telephones and telephone systems, including wireless 

telephone systems, is widespread. In wireless telephone systems, a 
cordless or wireless telephone handset unit communicates via either 
analog or digital radio signals with a base unit, which is typically 
connected via a standard telephone line to an external telephone 

15 network. In this manner, a user may employ the wireless handset to 
engage in a telephone call with another user through the base unit 
and the telephone network. 

Multi-line wireless telephone systems are in use in various 
situations, such as businesses with many telephone users. Such 

20 systems employ a handset that communicates with up to N handsets 
simultaneously, typically with digital communications schemes, such 
as a spread-spectrum, time division multiple access (TDMA). In a 
TDMA system, a single RF channel is used, and each handset transmits 
and receives data during a dedicated time slice or slot within an 

25 overall cycle or epoch. It is desirable to provide various features, 
such as private branch exchange (PBX) features and capabilities, in a 
multi-line wireless telephone system. 



BACKGROUND OF THE INVENTION 
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One problem that may be encountered in such situations is 
breach of security. For example, an unauthorized third party may use 
a "bootleg" wireless handset to communicate via the base unit. 
Without adequate security, these and other types of security breaches 
5 may occur. 

SUMMARY 

A wireless telephone system, having one or more wireless 
handsets and a base unit. Each handset has a handset transceiver, 

10 and the base unit has a base transceiver and a handset docking 
station, which has a wired interface. The base unit digitally 
communicates over an RF channel with a handset via its handset 
transceiver only if the handset has previously been initialized by the 
base unit. The handset is initialized via the wired interface when it is 

15 physically docked in the docking station. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a block diagram of TDMA multi-line wireless telephone 
system for initializing wireless handsets of the system, in accordance 
with an embodiment of the present invention; 

20 Fig. 2 is a schematic representation of the message format for an 

initialization message exchange between the base unit and a handset 
of the telephone system of Fig. 1 via a wired link, for initializing the 
handset, in accordance with an embodiment of the present invention; 

Fig. 3 is a flow diagram illustrating the handset initialization 
25 performed by the system of Fig. 1, from the point of view of the base 
station, in accordance with an embodiment of the present invention; 
and 
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Fig. 4 is a flow diagram illustrating the handset initialization 
performed by the system of Fig. 1, from the point of view of the 
handset being initialized, in accordance with an embodiment of the 



present invention. 



5 



DESCRIPTION OF THE PREFERRED EMBODIMENT 

Referring now to Fig. 1, there is shown a block diagram of 
spread spectrum TDMA multi-line digital wireless telephone system 
100, in accordance with an embodiment of the present invention. 

10 TDMA system 100 comprises a base unit 110, which has receiver and 
transmitter units 112 and 111, respectively, and is coupled to 
external telephone network 116 via telephone line(s) 115. Base unit 
110 also comprises docking station 118, for receiving a wireless 
handset and providing a wired interface between base unit 110 and 

15 the handset. In addition, base unit 110 also has a 

controller/microprocessor 113 for controlling and monitoring the 
overall functions of the base unit 110. 

System 100 also comprises N wireless handsets 120j, 1202, 
. . . 1 20 jsj . Each has a transmitter and receiver unit (transceiver), 

20 such as transmitter 121 and receiver 122 of handset 120j. In one 
embodiment, receiver unit 112 comprises N logical receivers, and 
transmitter unit 111 comprises N logical transmitters, so that receiver 
and transmitter units 112 and 111 provide N logical transceiver units, 
one for each of N wireless handsets. At any given time, M handsets (0 

25 < M < N) are operating or active (i.e., in the process of conducting a 
telephone call). 

The telephone system provided by system 100 preferably 
operates in the 900 MHz unlicensed band, and preferably provides 
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features like that of a small PBX, in conjunction with PC 140. In one 
embodiment, system 100 employs a combination of time division 
multiplexing (TDM), such as TDMA, and frequency band selection to 
overcome interfering sources and to maintain reliable links between 
5 the base-station and the handsets. In a digital TDMA scheme, each 
handset only transmits or receives data during its own "time slice" or 
slot. System 100 thus provides a wireless network between the base 
station 110 and each handset 120j (1 < i < N). In one embodiment, 
N=4, so that system 100 comprises a maximum of 4 wireless handsets, 
10 each having unique time slots in the TDMA epoch dedicated thereto. 

As explained above, lack or breach of security in such a system 
is undesirable. Therefore, the telephone system of the present 
invention is configured to minimize this problem and to provide 
secure and robust communications between handsets and the base 

15 unit. In the present invention, the base unit 110 is configured so that 
it will communicate only with handsets that are able to provide 
certain unique identifier (ID) information, or security code. This ID 
information may include information such as the slot number 
assigned to the handset (e.g., one of numbers 1-4 in a 4-line, 4-slot, 4- 

20 handset system), as well as the handset serial number and/or the 
base serial number (or security codes based on the serial number), 
and the like. Only handsets 120^ that have been initialized by base 
unit 110 will be able to provide this information to the base unit 110; 
all non-initialized handsets will therefore not be able to communicate 

25 as part of the telephone system 100. 

In an alternative embodiment, in addition to the use of security 
codes such as the serial number, and slot number, a user- 
programmable scrambler code is employed. In this embodiment, 
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during initialization, the user of the handset is prompted to enter a 
random scrambler seed. This scrambler seed is then stored in both 
handset and base unit, and is used to scramble all future TDMA 
communications between the two. Since only the initialized handset 
and the base unit know the scrambler seed, an unauthorized handset 
or other transceiver device will be unable to eavesdrop on the 
channel or use the handset's slot. Thus, the user-programmable 
scrambler provides an extra layer of security. In an alternative 
embodiment, the scrambler code or seed may be selected 
automatically by the base unit and/or handset, without prompting the 
human user for input. 

System 100 is configured so that base unit 110 has a physical 
docking station 118 or receptacle/port into which a non-initialized 
handset 120j may be physically placed, to provide a wired link and 
interface between the handset 120j and base unit 110. The handset 
is then initialized by the base unit via the wired link. Because the 
physical location of the base unit and its docking station or port may 
be controlled and access thereto limited to authorized persons, and 
because a handset must be physically docked to the docking station in 
order to engage in initialization, only an authorized person will be 
able to initialize a handset. Therefore, in the present invention, only 
handsets that have been initialized by the handset via the wired link, 
as a result of actions of an authorized user, will be able to engage in 
telephone communications with the telephone system, thus providing 
communication security. The present invention is described in 
further detail below, with reference to Figs. 2-4. 

Referring now to Fig. 2, there is shown a schematic 
representation of the message format 200 for an initialization 
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message exchange between the base unit 110 and a handset 120j of 
the telephone system 100 of Fig. 1 via a wired link, for initializing the 
handset 120j, in accordance with an embodiment of the present 
invention. Message format 200 comprises a plurality of fields 201- 
5 209 for the exchange of information between base unit 110 and a 
handset 120j via the wired link provided by port 118, which are 
exchanged in order to initialize the handset. Messages sent to a 
docked handset 120j from base unit 110 have message format 200, as 
do messages sent to base unit 110 from a docked handset 1 20j. Port 
10 118 may also double as the recharging port or cradle into which a 
handset may be placed to recharge its battery. 

Whenever a non-initialized handset 12Q X is placed in port 118 
and is to be initialized, the base unit 110 provides information to the 
handset, and vice-versa, to initialize the handset so that future TDMA 

15 communication may be conducted. In one embodiment, this 
information includes a security code or ID 205, a slot number 204, 
and a scrambler seed 207. In one embodiment, the security code is 
based on the serial number of the handset, and is preferably a 32 bit 
number. The security code may be identical to the serial number, or 

20 a part or subset thereof. In an alternative embodiment, the security 
code is based on the serial number for the base unit, instead of or in 
addition to that of the handset. The security code is used to 
authenticate the handset every time any messages are to be 
exchanged between the base and a handset. In addition to the time 

25 slot mechanism, this security code provides a secure exchange of 
messages from the base to the handset. 

The slot number for the handset is a 3 bit number, which is 
assigned by base unit 110, and transmitted via the wired link to the 
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handset. The slot number is a unique time slot number, which 
distinguishes handset 120j from other handsets in system 100. The 
scrambler seed is an 8-bit number, also based on the serial number of 
the base unit, or, alternatively, user programmable through a serial 
5 computer interface or other input (e.g. the keypad of the wireless 
phone), and is used to generate the code that randomizes the 
spectrum of transmitted information. Since such encoding employs a 
deterministic mapping, which is known only to the transceivers of the 
handset and base unit, it can provide additional security, as described 
10 above. 

Message format is, in one embodiment, a 72-bit field 2 00 
having an unused field 208 for future expansion as shown in Fig. 2. 
Message number field 201 is a 4-bit field, modulo generated at each 
end of a transmission, which helps keep track of the state of the 

15 other end. This field is also used for positive acknowledgments. 
Message type field 202 is a 4-bit field, used to signal different types 
of messages that can possibly be exchanged between base and 
handsets. New/existing field 203 is a 1-bit field that indicates 
whether the handset is a new handset or existing handset, where 0 = 

20 new handset. For packets originating from base unit 110, this field is 
always set to 0. 

As described previously, local number field 204 is a 3-bit field 
that indicates the local (slot) number assigned to an existing handset. 
This number is ignored if new/existing field 203 is set to 0. 32-Bit ID 
25 field 205 indicates the security code or ID, which is derived from the 
factory designated ID for handset 120j. This will form the basis for 
secure communications between the base and handsets registered 
with the base (i.e., initialized). A 5-bit ack message field 206 contains 
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the 4-bit message number that is being acknowledged, plus an ack 
bit. In this format, bits 0-3 represent the message number being 
acknowledged, and bit 4 represents negative ack if 0, and positive ack 
if 1. The generation of the acknowledgment is based on the CRC check 
done at the receiving end. Scrambler seed field 207 is an 8-bit field 
used to seed the scrambler in the RF link. It forms an additional layer 
of security. This may be default generated from the factory code or 
programmed through the serial computer interface by a user. 
code field 209 is an 8-bit cyclic redundancy check code used for error 
detection and correction. 

Referring now to Fig. 3, there is shown a flow diagram 3 00 
illustrating the handset 120j initialization performed by system 100 
of Fig. 1 under the control of CPU 113, from the point of view of base 
station 110, in accordance with an embodiment of the present 
invention. A handset placed or "docked" into port 118 may be 
already initialized and docked only for recharging. Alternatively, a 
non-initialized handset (i.e., either a "new" handset that has never 
been initialized, or a handset previously initialized for a different 
base unit) may be docked in port 118 in order to initialize the 
handset for base unit 110. Additionally, an already-initialized 
handset may be docked in port 118 in order to re-program or change 
some of the initialization parameters, i.e. to re-initialize the handset. 
In the latter cases, the handset may still need recharging. 

Thus, base unit 110 first polls the relevant I/O device to detect 
the presence of the handset on the recharge cradle, i.e. port 118 (step 
301). When a handset 120j is docked in port 118 (i.e., the recharge 
cradle), base unit 110 first checks to see if the voltage level of the 
battery of handset 1 20 j is above a certain threshold that would 
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permit normal functioning of the handset (step 302). If not, no 
further processing steps take place until the handset recharges to a 
sufficient voltage. 

Once the threshold voltage requirement is satisfied (step 302), 
5 base unit 110 initiates the messaging protocol, in accordance with 
message format 200, by sending the initial message through the 
wired interface of port 118 to the handset 120j (step 303). This 
message is a sign on message which is indicated in the message type 
field 202 with 0. This starts a sequence of events that are described 

10 from the viewpoint of base unit 110 in Fig. 3 and from the viewpoint 
of handset 120j in Fig. 4. All messages exchanged between the 
handset and base are asynchronous in nature. The general goal of 
this procedure is to either allow for a normal recharge or to initialize 
a non-initialized handset. In the initial message, base unit 110 fills in 

15 the following fields: message number field 201, message type filed 
202 (where sign on message =0), and the CRC field 209. (If the OSZ 
does not match at the handset, it sends a negative acknowledge back 
to base unit 110 with the message number, in which case base unit 
110 sends a retransmit message to the handset (not shown in Fig. 3). 

20 All messages with CRC need acknowledgment even where not 
indicated in Fig. 3.) 

At this point, base unit 110 expects an acknowledge from 
handset 120^ (step 304). If an acknowledge is not received before a 
timer times out, the procedure starts again (steps 305, 306, 301). If 
25 an acknowledge is received before time out (step 304), then base unit 
110 can determine whether the docked handset is "new" or has 
already been initialized (step 311). Handset 120j at step 311 may 
have one of 3 states: it may be a new handset, it may be already 
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initialized by base unit 110, or it may have been initialized previously 
by a different base unit. 

In case the handset's message indicates a new handset (in which 
case the handset's message contains the handset's ID in field 205), the 
base needs to check if it has a local number or slot available (step 
312). For example, in a 4-handset system, if 4 handsets are already 
initialized and thus registered with base unit 110, no slot will be 
available. If the base unit 110 has an available local number, then 
the base unit 110 will assign it to the handset by updating the 
message fields (step 313). In this case, base unit 110 fills out the 
following fields for the message: message number field 201, message 
type field 202, unique system ID field 205, local slot number 
assignment field 204, scrambler seed field 207, and CRC field 209. In 
this case, ID field 205 contains the serial number of base unit 110. 

If it is determined that handset 120^ is new, but there is no slot 
available (step 312), base unit 110 assumes that the user is trying to 
replace an existing handset with handset 120^. In this case, the user 
is prompted to provide information about what local number needs to 
be replaced. This is accomplished by a message sent from the base to 
the handset which then displays a Local Number request and an audio 
warning (step 321). Once a response with a valid slot number is 
received from the handset as a result of this query (steps 322, 323), 
base unit 110 completes the local slot number assignment and fills 
out the specified fields for the message (step 313). If no response is 
received from the handset, a timeout is issued and the base starts at 
the top of its execution (step 324). 

When handset 120j is not a new handset (step 311), base unit 
110 checks the 32 bit ED, local number, and scrambler seed 
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transmitted by handset 120j. If these numbers match the 
information stored in base unit 110's memory, the base program exits 
(step 331). If there is a mismatch, then the base sends a reprogram 
message (message type = 8) to the handset (steps 331, 332). This 
message is filled in the following fields: message number field 201, 
message type field 202, and CRC field 209. 

If base unit 110 receives a positive acknowledgment, it follows 
the processing chain as if it is dealing with a new handset, so that it 
can re-initialize the handset (steps 333, 312). In case it receives a 
negative acknowledge or times out, it exits the service routine (steps 
333, 334, 335). 

Referring now to Fig. 4, there is shown a flow diagram 4 00 
illustrating the handset 1 20 j initialization performed by system 100 
of Fig. 1, from the point of view of handset 120j, in accordance with 
an embodiment of the present invention. As will be appreciated, the 
processing flow in handset 120j mirrors that in base unit 110, 
described above with reference to Fig. 3. Once the initial sign-on 
message is received correctly from the base (step 403), handset 120j 
responds with an acknowledgment including old/new and related 
handset information (step 404). In particular, if the handset is new, it 
responds (step 404) with a message having the following fields filled 
in: message number field 201, message type field 202 (=1), 
new/existing handset field 203 (=0; "new"), and CRC field 209. If 
handset 120j has already been initialized, it responds with a message 
having the following fields filled in: message number field 201, 
message type field 202, new/existing handset field 203 (=1; 
"preinitialized"), unique system ID field 205, local slot number 
assignment field 204, scrambler seed field 207, and CRC field 209. 
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The rest of the processing chain shown in Fig. 4 (steps 405 et 
seq.) is a reflection of actions requested by the base. As discussed 
above, handset 120j needs to have a response for each of the possible 
states that it can be in. In particular, depending on its initial status 
5 (which is one of 3 possible conditions discussed in the previous 
section), the base may request the following actions: local slot 
number assignment (step 406); User to Provide Local Message 
Assignment (step 407); or HS vs. Base ED Mismatch (step 408) 
(implying a requirement for a possible reprogramming of the handset 

10 based on the user's request). This allows a handset to be recharged in 
another base with the user prompting such an action only. Also, in 
the case where only a recharging function is carried out, there is no 
unique ring tone at the completion of the action. All other actions in 
the handset on completion result in a unique ring tone (step 425) 

15 which signals to the user that the handset and base have completed 
their actions. 

One skilled in the art will recognize that the wireless system 
described above according to the principles of the invention may be a 
cellular system where base unit 110 represents a base station serving 
20 one of the cells in a cellular telephone network. 

It will be understood that various changes in the details, 
materials, and arrangements of the parts which have been described 
and illustrated above in order to explain the nature of this invention 
may be made by those skilled in the art without departing from the 
25 principle and scope of the invention as recited in the following claims. 
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CLAIMS 



1. A wireless telephone system, comprising: 

5 (a) one or more wireless handsets, each handset comprising a 

handset transceiver; and 
(b) a base unit comprising a base transceiver for communicating 
over a channel with each handset via its handset 
transceiver only if the handset has previously been 
10 initialized by the base unit; a handset docking station 

having a wired interface; and 

means for initializing the handset via the wired interface. 

2. The system of claim 1, wherein: 

15 the means for initializing obtains from the handset and stores 

locally a unique handset security code; and 
the base unit allows a given handset to communicate over the 
channel only if the handset provides to the base unit the 
handset security code. 

20 

3. The system of claim 2, wherein: 

the means for initializing further provides a unique base unit 

security code to the handset; and 
the base unit allows a given handset to communicate over the 
25 channel only if the handset provides to the base unit the 

base unit security code and the handset security code. 
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4. The system of claim 2, wherein: 

the base transceiver establishes a time-division multiple access 
(TDM A) link with each handset via the handset 
transceiver in accordance with a TDMA epoch allocating 
exclusive audio packet time slots to each handset; 

the means for initializing obtains from the handset and stores 
locally a unique handset security code and provides to the 
handset an exclusive audio packet slot number 
corresponding to its audio packet time slot; and 

the base unit allows a given handset to communicate over the 
RF channel only if the handset provides to the base unit 
the handset security code and the audio packet slot 
number. 

5. The system of claim 2, wherein: 

digital communications between the base transceiver and the 
handset are scrambled in accordance with a scrambler 
seed unique to the handset that must be known to both 
the base transceiver and the handset; and 

the means for initializing provides to the handset and stores 
locally the scrambler seed for the handset. 

6. The system of claim 2, wherein the handset security code is 
based on a unique handset serial number. 
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15 



7. The system of claim 1, wherein: 

the means for initializing provides to the handset a unique base 
unit security code based on a unique base unit serial 
number; and 

the base unit allows a given handset to conduct digital 
communications over the RF channel only if the handset 
provides to the base unit the base unit security code and 
the handset security code. 

8. The system of claim 1, wherein: 

each handset is battery powered by a rechargeable battery; and 
the docking station comprises a charging means for recharging 

the battery of a handset physically docked in the docking 

station. 

9. The system of claim 8, wherein: 

the base unit comprises means for determining whether the 
battery of the handset physically docked in the docking 
station has a voltage below a threshold level, wherein the 
means for initializing waits until after the battery voltage 
has been recharged above the threshold level before 
initializing the handset. 



25 10. The system of claim 1, wherein the handset and base unit 

exchange messages during the initialization in accordance with a 
message format comprising a plurality of fields. 
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11. In a wireless telephone system having a base unit and one 
or more wireless handsets, the base unit comprising a base 
transceiver and a handset docking station having a wired interface, 
each handset comprising a handset transceiver, a method comprising 
the steps of: 

(a) initializing a handset via the wired interface when the 

handset is physically docked in the docking station; and 

(b) conducting digital communications, over an RF channel, 

between the base unit and the handset via the base unit 
and handset transceivers, respectively, only if the handset 
has previously been initialized by the base unit. 

12. A base unit for communicating with one or more wireless 
handsets, each handset comprising a handset transceiver, comprising: 

(a) a base transceiver for digitally communicating over an RF 

channel with each handset via its handset transceiver only 
if the handset has previously been initialized by the base 
unit; and 

(b) a handset docking station having a wired interface, wherein 

the base unit initializes the handset via the wired 
interface when the handset is physically docked in the 
docking station. 



WO 99/31859 



1/3 



PCT/US98/180S9 



100 





o 
o 
o 




FIG.1 



200 



MESSAGE 
NUMBER 
4 BITS 



MESSAGE 
TYPE 
4 BITS 



NEW/ 
EXISTING 
1 BITS 



LOCAL 
NUMBER 
3 BITS 



32 BIT ID 



ACK 
MESSAGE 
5 BITS 



SCRAMBLER 
SEED 
8 BITS 



UNUSED 
7 BITS 



201 



^202 ^ 



203 



204 



205 



206 



207 



208 



8 BIT 
CRC 



209 



F 



SUBSTITUTE SHEET (RULE 26) 



WO 99/31859 



PCT/US98/18059 



2/3 




COUNTDOWN 




YES 


335 . 






SEND MESSAGE 
TO HS TO TYPE 
IN DESIRED 
LOCAL # 




3. 



313 



ASSIGN LOCAL HO 
HS AND SEND LOCAL tf, 
ID ETC. TO HS 



ok>- 



2_ 



EXIT 



SUBSTITUTE SHEET (RULE 26) 




WO 99/31 859 PCT/US98/1 8059 

3/3 

400 




SUBSTITUTE SHEET (RULE 26) 



INTERNATIONAL SEARCH REPORT 



!nU^0Rnat Application No 

PCT/US 98/18059 



A. CLASSIFICATION OF SUBJECT MATTER 

IPC 6 H04M1/72 



According to International Patent Classitication (IPC) or to both national classitication and IPC 



B. FIELDS SEARCHED 



Minimum documentation searched (classification system followed by ciassilication symbols) 

IPC 6 H04M H04Q 



Documentation searched other than minimum documentation to the extent that such documents are included in the fields searched 



Electronic data base consulted during the international search (name of data base and. where practical, search terms used) 



C. DOCUMENTS CONSIDERED TO BE RELEVANT 



Category - 


Citation of document, with indication, where appropriate, of the relevant passages 


Relevant to claim No. 


X 


EP 0 304 998 A (PHILIPS NV) 1 March 1989 


1,8,10 


Y 


see column 2, line 29 - column 3, line 3 


2.3,11, 






12 




see column 4, line 5-10; figure 1 






see column 5, line 43 - column 6, line 49; 






figure 5 




A 


see column 6, line 18-22 


9 


Y 


US 5 495 520 A (KOJIMA SUSUMU) 


2,3 




27 February 1996 




see abstract; figure 1 






see column 2, line 5-54 




Y 


US 5 625 888 A (RUETHER RALF ET AL) 


11,12 




29 April 1997 


A 


see column 2, line 10-41; claim 1 


4 ■ 




-/- 





m 



Further documents are listed in the continuation of box C. 



Patent family members are listed in annex. 



* Special categories of cited documents : 

"A" document defining the general state of the art which is not 
considered to be of particular relevance 

"E" earlier document but published on or after the international 
filing date 

"L" document which may throw doubts on priority claim(s) or 
which is cited to establish the publication date of another 
citation or other special reason (as specified) 

"O" document referring to an oral disclosure, use. exhibition or 
other means 

"P" document published prior to the international filing date but 
later than the pnorrty date claimed 



T" later document published after the international filing date 
or pnonty date and not in conf lid with the application but 
cited to understand the principle or theory underlying the 
invention 

"X" document of particular relevance: the claimed invention 
cannot be considered novel or cannot be considered to 
involve an inventive step when the document is taken alone 

*'Y" document ot particular relevance; the claimed invention 

cannot be considered to involve an inventive step when the 
document is combined with one or more other such docu- 
ments, such combination being obvious to a person skilled 
in the art. 

document member of the same patent family 



Date of the actual comptetion of the tntemationai search 



8 December 1998 



Date of mailing of the international search report 

18/12/1998 



Name and mailing address of the ISA 

European Patent Office. P.B. 5818 Patentlaan 2 
NL - 2280 HV Rijswijk 
Tel. <+3l-70) 340-2040. Tx. 31 651 epo nl. 
Fax: (+31-70) 340-3016 



Authorized officer 



De Biol ley, L 



Form PCT/ISA/210 (second sheet) (July 1992) 



page 1 of 2 



INTERNJPKONAL SEARCH REPORT 



Int ^^Pcnal Application No 

PCT/US 98/18059 



C.(Conttnuation) DOCUMENTS CONSIDERED TO BE RELEVANT 



Category - Citation ot document, with indication. where appropnate. ot the relevant passages 



Relevant to claim No. 



EP 0 301 573 A (NIPPON ELECTRIC CO) 
1 February 1989 

see column 1, line 32 - column 2, line 3 

US 5 371 783 A (HEUNG CHARLEY ET AL) 
6 December 1994 
see abstract 

see column 3, line 13-17 

see column 3, line 54 - column 5, line 57 



6,7 



I, 5,8, 

II, 12 



Form PCT/ISA/210 (continuation ot second sheet) (July 1992) 



page 2 of 2 



INTERS 


■PHONAL SEARCH REPORT |"J 


^^Sonal Application No 


Information on patent lamiiv members 














| PCT/US 98/18059 


Patent document 


r UDKCctUOn 




Patent family 




Publication 


cited in search report 


date 








date 


EP 0304998 A 


01-03-1989 


GB 


2209109 


A 


26-04-1989 






0E 


3882182 


A 


12-08-1993 






DE 


3882182 


T 


27-01-1994 






tiK 


140294 


A 


16-12-1994 






JP 


1071331 


A 


16-03-1989 






KR 


9702755 


B 


10-03-1997 








146694 


G 


16-06-1995 






US 


4905272 


A 


27-02-1990 


US 5495520 A 


27-02-1996 


JP 


2531349 


B 


04-09-1996 






JP 


7038955 


A 


07-02-1995 


US 5625888 A 


29-04-1997 


DE 


4236778 


A 


05-05-1994 






AU 


673202 


B 


31-10-1996 






AU 


5148093 


A 


24-05-1994 






CA 


2148278 


A 


04-05-1994 






CA 


2148287 


A 


11-05-1994 






WO 


9410785 


A 


11-05-1994 






• DE 


59306696 


D 


10-07-1997 






DK 


667078 


T 


29-12-1997 






CD 

tr 


0667078 


A 


16-08-1995 






ES 


2103491 


T 


16-09-1997 






FI 


952050 


A 


28-04-1995 






JP 


2726160 


B 


11-03-1998 






JP 


7508631 


T 


21-09-1995 


EP 0301573 A 


01-02-1989 


JP 


1036130 


A 


07-02-1989 






JP 


2564839 


B 


18-12-1996 






JP 


1129557 


A 


22-05-1989 






JP 


1926895 


c 


25-04-1995 






JP 


6054925 


B 


20-07-1994 






AU 


594624 


B 


08-03-1990 






r ft 
LA 


1291834 


A 


05-11-1991 






DE 


3880038 


A 


13-05-1993 






HK 


143194 


A 


23-12-1994 






SG 


153194 


G 


28-04-1995 






US 


4864599 


A 


05-09-1989 


US 5371783 A 


06-12-1994 


CA 


2059734 


A,C 


30-11-1992 






r a 
LA 


2151516 


A 


30-11-1992 






GB 


2257332 A,B 


06-01-1993 






GB 


2268370 


A,B 


05-01-1994 






JP 


7087561 


A 


31-03-1995 






US 


5297203 


A 


22-03-1994 





Foim PCT/ISA/210 (patent tamily annex) (July 1992) 



